CVE-2026-70124

CVE-2026-70124 is an out-of-bounds read (CWE-125) in the Windows DHCP Server service. A remote, unauthenticated attacker can likely trigger it by sending crafted DHCP network traffic to a system running the DHCP Server role (DHCP servers listen on UDP 67), causing the service to read beyond the bounds of an allocated buffer. The impact is disclosure of memory contents on the affected host: the CVSS vector scores confidentiality as high with no integrity or availability impact, and no privileges or user interaction are required, so there is no indication of remote code execution. Affected organizations are those running Windows 10 1607/1809 or Windows Server 2012/2016/2019/2022/2025 with the DHCP Server service enabled, which in practice means Windows Server hosts acting as DHCP servers on internal enterprise networks. As of this analysis there is no known in-the-wild exploitation, no public proof-of-concept, the flaw is not in CISA's KEV, and EPSS estimates roughly a 0.8% probability of exploitation in the next 30 days.

What to do: Inventory Windows hosts running the DHCP Server role/service and apply Microsoft's security update for CVE-2026-70124 when released, prioritizing DHCP servers reachable from untrusted or unmanaged network segments; as an interim mitigation, restrict UDP 67 access to DHCP servers with network ACLs. Note that Windows 10 client systems are only affected if the DHCP Server service has been enabled, which is uncommon, and treat the confidentiality-only impact as potentially exposing sensitive memory contents on the server.